Description

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.0 is recommended to address this issue. The name of the patch is 4562. It is advisable to upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "These five reports are variants of the same root cause: validation of shell commands containing multiple segments, wrappers, comments, or chained commands. The issue was fixed by validating every executable shell segment against the configured allowlist".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-07T20:16:50.913Z",
  "pubdate": "2026-08-07T20:16:50.913Z",
  "executiveSummary": "A remote OS command injection vulnerability has been identified in HKUDS nanobot up to version 0.2.1. The flaw resides within the Shell Allowlist Handler component, specifically inside the ExecTool._guard_command and ExecTool._spawn functions located in nanobot/agent/tools/shell.py. This security deficiency allows unauthorized remote attackers to bypass existing command validation mechanisms and execute arbitrary operating system commands on the underlying host system. The root cause stems from improper validation of shell commands that incorporate multiple segments, wrappers, comments, or chained commands. Because a public exploit has been disclosed, the risk of active exploitation is elevated. Successful exploitation grants attackers unauthorized system access and execution capabilities with the privileges of the running application. Immediate remediation is required to secure affected environments.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw affecting the Shell Allowlist Handler component of HKUDS nanobot up to version 0.2.1. The vulnerable functions, ExecTool._guard_command and ExecTool._spawn, are implemented in the file nanobot/agent/tools/shell.py. The primary root cause of this vulnerability involves insufficient validation logic when parsing shell commands. Specifically, the original implementation failed to properly validate every executable shell segment against the configured allowlist when inputs contained complex structures such as multiple segments, shell wrappers, comments, or chained execution operators.\nThe attack flow enables a remote attacker to craft a malicious payload containing chained commands or wrapper constructs designed to bypass the simplistic checks enforced by the ExecTool._guard_command function. When the input is processed by ExecTool._spawn, the underlying shell interprets the malicious segments that evaded validation, executing arbitrary operating system commands outside the intended security boundaries. Exploitation does not require prior authentication or elevated privileges, provided the vulnerable endpoint is exposed to the network.\nThe post-exploitation impact includes full system compromise, unauthorized data exfiltration, lateral movement within the network, and complete control over the host execution environment. To address this architectural weakness, the project released patch 4562, which alters the validation mechanism to inspect and validate every individual executable shell segment against the configured allowlist, successfully neutralizing command chaining and wrapper bypass techniques."
}